I am in a very client facing role, and my clients quite like me. You know nothing about me, and you are completely misunderstanding this situation. I am holding the researcher accountable to how they comported themselves in this interaction instead of dick-riding a fellow hacker I actually do understand what security researchers usually want out of such an interaction. Where things fall apart is that the CEO does _not_ know, then the researcher punished them for their behavior and accessed their data, likely illegally. I am trying to communicate why they got a bad response, and why their response to the bad response was bad. I probably shouldn't have mentioned blackmail because people are focusing on that. I'm mainly trying to say "it reads like it could be blackmail" and they'd have a friendlier interaction with just a little more info upfront.

He is absolutely in his right to write a post about it. He even tried to mediate with a third party. You are delusional if you think somebody owes you something in that situation.

> I'm simply trying to say the researcher would have more pleasant interactions with the people they email if they helped the person understand what they _do_ want out of the interaction instead of just saying they aren't being scammed. If the researcher placed themselves in the shoes of the CEO, they could understand why the CEO responded that way. That's not the same thing as thinking the CEO _should_ have responded that way. I am also not letting the researcher off the hook for responding to the CEOs response the way they did.

You are right if you just look at the emails you are disregarding the attempt to mediate via a reputable third party. In which the ceo reacted in the same way.